If you set up a Cyber Essentials assessment account before 27 April 2026, you can still complete it under the current requirements — often called Willow (version 3.2). After that date, new assessment accounts move to the Danzell update (Cyber Essentials v3.3), which raises the bar on several controls.

This article explains whether your existing assessment window is still open, what actually changes when Danzell takes effect, and how to decide whether to rush submission or plan for the new standard.

Can You Still Submit Under Willow (v3.2)?

Yes — but only if you already have an active assessment account on the IASME portal created before 27 April 2026.

Here is the practical split:

• Assessments set up before 27 April 2026 — assessed against the current v3.2 Willow requirements. You keep working on them under those rules until certification.

• Assessments initiated on or after 27 April 2026 — assessed against the new v3.3 Danzell requirements from day one.

This matters because the transition does not just tweak wording — it changes which controls carry real weight in the marking scheme.

What Is the Danzell Update (v3.3)?

Danzell is the codename for Cyber Essentials v3.3, published by IASME in February 2026 and effective from 27 April 2026. It updates the Requirements for IT Infrastructure document and introduces stricter marking criteria — not new control categories.

The five technical controls remain the same:

1. Firewalls and network security

2. Secure configuration

3. User access control

4. Malware protection

5. Patch management

What changes is how strictly each control is scored. Under v3.2, gaps could sometimes be offset by compensating controls or assessor discretion. Under Danzell, specific questions cause immediate failure regardless of how well the rest of the assessment goes.

What Actually Changes Under Danzell?

The most material shift is the introduction of auto-fail criteria. Under v3.2, a single gap could be offset by compensating controls or assessor discretion. Under v3.3, specific questions cause immediate failure on their own, regardless of how well the rest of the assessment goes.

Two patch management questions (A6.4 and A6.5) become auto-fail items: high-risk or critical security updates must be applied within 14 days. If they are not, the assessment fails outright — even if every other control is met.

MFA coverage also tightens. If multi-factor authentication is available for a cloud service but has not been enabled, the organisation automatically fails that control area.

Backup and recovery guidance has received increased emphasis. While not mandatory, IASME now recommends documented backup procedures — something that previously flew under the radar for many small businesses.

Should You Rush to Submit Under Willow?

It depends on your current posture.

If your organisation already meets or exceeds the v3.2 requirements — particularly around MFA coverage, patching cadence, and documented security policies — an early submission makes sense. You are working with a familiar standard, and you know where your gaps are.

But rushing carries its own risk. You may fail anyway, and the effort of re-preparing for Danvell will not be saved.

A practical decision framework

Ask yourself two questions:

1. Do you already have MFA enabled on all cloud services where it is available?

2. Can you demonstrate that critical and high-risk security patches are applied within 14 days?

If you answered "yes" to both, an early submission under Willow makes sense. If not, planning for Danvell may be the more efficient use of time.

How Long Do You Have Under Each Standard?

Once certified under Willow, your certificate remains valid for 12 months. Renewal must be done against whatever standard is active at the time of renewal.

If you started your assessment before 27 April 2026, you have until 27 October 2026 to complete under Willow. That is the standard window — six months from account creation. After that, even an incomplete assessment moves to the new requirements.

What This Means for SMEs in Sussex and Kent

For managed service providers and SMEs across Sussex and Kent, the transition is less about scrambling and more about making an informed decision. The five technical controls have not changed — only the rigour with which they are assessed.

Organisations that already maintain a proper security baseline see this as an opportunity to build structure before the bar rises further. Those that have been managing security ad hoc will find less room for ambiguity under Danvell.

Frequently Asked Questions

Can I switch from Danzell back to Willow once my account is live?

No. The standard applied to your assessment is locked in at the point your IASME account is created. If your account was set up on or after 27 April 2026, it will be assessed against the Danvell requirements.

Does Cyber Essentials v3.2 Willow become invalid after April 2026?

No. Existing assessment accounts created before 27 April 2026 continue under v3.2 until certification is complete. The transition only affects accounts created on or after that date.

Can I still pass Cyber Essentials v3.2 if I am not fully compliant?

Under v3.2, the marking scheme allows some flexibility through compensating controls. If you have a gap in one area but strong controls elsewhere, an assessor may still award certification. Under v3.3, that flexibility is significantly reduced — auto-fail questions remove the possibility of compensation entirely.

How does Cyber Essentials self-assessment differ from assessed under v3.3?

Cyber Essentials is a self-assessment (verified) or accredited-assessor scheme. Cyber Essentials Plus adds an independent technical verification stage. Both move to Danvell v3.3 from 27 April 2026 for new accounts.

Next Steps

If you want to know whether your organisation can still submit under the current Willow standard — or whether it is more efficient to plan for Danvell — book a free Security Triage Call. It is a short, structured conversation to map your current posture against both standards so you can decide with clarity.

Book your Security Triage Call

If you are already working toward certification, our Cyber Essentials support page covers the full process from gap assessment through to certification. For insight into how we approach security baselines across our client base, read about the managed IT support standard we operate by default.